What information I collect
Your name, address, contact details and date of birth
Your medical history, current health conditions, medications and any relevant previous treatments
Session notes recording what we worked on and any changes you noticed
Any recommendations I made, including referrals to other practitioners or your GP
Records of your consent to treatment
Why I collect it and my lawful basis for doing so
I collect this information in order to provide you with safe and appropriate treatment. The law requires me to identify a lawful basis for holding personal data:
Contract: I process your basic contact and booking information because it is necessary to provide the service you have engaged me for.
Legitimate Interests: I maintain clinical notes and session records because I have a legitimate professional interest in doing so — to provide you with continuity of care, to meet my professional body’s standards, and to be able to respond to any questions or complaints about the treatment I have provided.
For Special Category health data, I also rely on Article 9(2)(h) of UK GDPR: processing necessary for the provision of healthcare by a practitioner subject to a professional confidentiality obligation. As a member of the Cranio Sacral Society, I am bound by their Code of Ethics, which includes a duty of confidentiality.
Who I might share your information with
Your information is kept confidential. In the normal course of my practice I may, however, share it in limited circumstances:
Clinical supervision: I discuss cases with my supervisor for professional development purposes. I use initials or anonymised details wherever possible. Where full identification is necessary, you will have been informed.
Professional indemnity insurer: If a claim or complaint is made, my insurer may need to see relevant records.
Your GP or another health professional: Only with your agreement — except in an emergency or where there is a risk to your safety or someone else’s (see safeguarding below).
Safeguarding: If I have a serious concern about your safety or that of a child or vulnerable adult, I may be legally required to share information with the relevant authority. This overrides my duty of confidentiality. I will always try to discuss this with you first unless doing so would put you or someone else at risk.
I do not share your information for marketing purposes or with any third party not described above.
How long I keep your records
Adult clients: I keep your records for a minimum of 7 years after your last appointment. This aligns with the limitation period for professional negligence claims and the requirements of my professional indemnity insurance.
Clients who were under 18 at the time of treatment: Records are kept until you reach the age of 25, or for 8 years after your last appointment — whichever is longer.
After this period, records are securely destroyed: paper records are shredded; electronic records are permanently deleted.
Keeping your records secure
I take the security of your records seriously. Paper records are kept in a locked filing cabinet and are not left out when not in use. Electronic records are stored on encrypted, password-protected devices with access restricted to me. Any third-party software I use to store or manage client information (such as booking systems or practice management software) is GDPR-compliant and subject to a Data Processing Agreement.
Your rights
Under UK GDPR, you have the following rights in relation to your personal data:
Right of access: You can request a copy of the information I hold about you at any time. I will respond within one calendar month, free of charge.
Right to rectification: If any information I hold is inaccurate, you can ask me to correct it.
Right to erasure: You can ask me to delete your records. Please note that this right is not absolute — I may need to retain records for legal or professional reasons, in which case I will explain why.
Right to restriction: You can ask me to limit how I use your data, for example while a dispute is being resolved.
Right to object: You can object to processing based on legitimate interests.
To exercise any of these rights, please contact me using the details at the top of this notice.
If you have a concern about how I handle your data
I take data protection concerns seriously. If you are unhappy about how I have handled your personal information, please contact me first and I will do my best to resolve your concern. I aim to acknowledge all complaints within 30 days.
If you remain unhappy after raising your concern with me, you have the right to complain to the Information Commissioner’s Office (ICO):
Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Telephone: 0303 123 1113
Website: ico.org.uk
Changes to this notice
I may update this notice from time to time. Any changes will be shared with you and will be available on request. The date at the top of this notice shows when it was last updated.
